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. 3)n Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 
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Application Papers 
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Claim Rejections - 35 USC §112 

1 , The following is a quotation of the first paragraph of 35 U.S.C. 112:. 

The specification shall contain a written description of the invention, and of the manner and process of making 
and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the an to which it 
pertains, or with which it is most nearly connected, to make and use the same and shall set forth the best mode 
contemplated by the inventor of carrying out his invention. 

2. Claim 6 is rejected under 35 U.S.C. 1 12, first paragraph, as a single means claim. 

A single means claim, i.e., where a means recitation does not appear in combination with 
another recited element of means, is subject to an undue breadth rejection under 35 
U.S.C. 112, first paragraph, in re Hyatt, 708 F.2d 712, 714-715, 218 USPQ 195, 197 
(Fed. Cir. 1983) (A single means claim which covered every conceivable means for 
achieving the stated purpose was held nonenabling for the scope of the claim because the 
specification disclosed at most only those means known to the inventor.). When claims 
depend on a recited property, a fact situation comparable to Hyatt is possible, where the 
claim covers every conceivable structure (means) for achieving the stated property (result) 
while the specification discloses at most only those known to the inventor. 
Claims 7-9, 14 and 15 are rejected as the claims depending on claim 6. 

1 . The following is a quotation of the second paragraph of 35 U.S.C. 1 12: 

The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the 
subject matter which the applicant regards as his invention. 

2. Claims 1-15 are rejected under 35 U.S.C. 1 12, second paragiaph, as being indefinite for 
failing to particularly point out and distinctly claim the subject matter which applicant regards as 
the invention. 

Claims 1, 6 and 12 limitations, directed to "capturing a data stream", are unclear, because 
it is not understood what capturing a data stream means in the context of the claims: saving a 
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data stream in a memory device for analysis, as no memory for saving the stream is mentioned in • 
the disclosure, or monitoring real-time data stream without saving the data stream. 

Claim 1 recites the limitation ''the totality of the stream' in line 5 and "the protocol" in 
line 6. There is insufficient antecedent basis for these limitations in the claim. 

Claim 2 recites the limitation "the captured packet" in line 2 and "the resources" in line 8. 
There is insufficient antecedent basis for these limitations in the claim. 

Claim 3 recites the limitation "the level considered" in line 2 and "the rule" in line 6. 
There is insufficient antecedent basis for these limitations in the claim. 

Claim 6 recites the limitation "the device" in line 1, "the analysis" in line 1 and "the 
method" in line 3. There is insufficient antecedent basis for these limitations in the claim. 

Claim 12 recites the limitation "the analysis" in line 1, "the method" in line 3 and "the 
totality of the stream" in line 5. There is insufficient antecedent basis for these limitations in the 
claim. 

Claims 1. 6 and 12 limitations directed to "the totality of the stream" are unclear, because 
it is not understood if "the totality of the stream" means all the packets of the stream or it means 
something else. 

Claims 4, 9, 10, 1 1 and 15 limitations directed to "means of tests of statistical or protocol 
analysis" are unclear as written. 

Claim 12 limitations directed to "capturing a means for capturing a datastream" are 
unclear as written. 
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Claim 12 limitations directed to "reiterating the step of analysis for a higher layer" are 
unclear, because the claim 12 limitations are directed to means and the means of the claim 
comprise no steps. 

These are only the examples of the claims clarity problems. All the claims should be 
revised to clarify the subject matter which applicant regards as the invention . 

Claim Rejections - 35 USC § J 02 

3. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the 
basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an applicaiion for patent, published under section 122(b), by another filed 
. in the United States before the invention by the applicant for patent or (2) a patent granted on an application for 
patent by another filed in the United States before the invention by the applicant for patent, except that an 
international application filed under the treaty defined in section 351 (a) shall have the effects for purposes of this 
subsection of an application filed in the United Slates only if the international application designated the United 
States and was published under Article 21(2) of such treaty in the English language. 

4. Claims L 6 and 12 are rejected (as best understood) under 35 U.S.C. 102(e) as being 
anticipated by Dietz (US 6,65 1 ,099). 

5. Regarding claims 1 , 6 and 1 2, Dietz teaches a method and a device for analyzing of data 
sti*eams in a communications network modeled by several layers (analyzer/monitor 108, shown 
on Fig. 1, 3 and 15, to. analyze network connection flows utilizing multiple layers/levels 3:23- 
4: 1 7), comprising the following steps: . 

capturing a datastream (examining all packets at the analyzer 108 connection point 121, 
as shown on Fig. 1 and 8:57-9:7); 
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for a given network layer, analyziiig the totality of the stream in order to determine the 
protocol or protocols present (for a layer, selected from a layer selections 338, as shown on Fig. 
3 and 1 1 :42- 12:36. analyzing the packets stream to determine the packets protocol, according to 
protocol specific information 1 1 :59-12:l 1); 

producing different streams corresponding to at least one protocol present (utilizing 
unique flow signature to create different flows 13:9-29, wherein the flows are classified into 
known or new 13:54-14:48); and 

reiterating said analyzing step for a higher layer if any (analyzing packets according 
higher layers, as described on 9:28-57, to determine the flow layers and applications 12:23-34). 

In addition, regarding claims 6 and 12, Dietz teaches implementation of the network 
monitor, as described above, based on a processor 1504, utilizing capturing means as packet 
acquisition device 1502, analyzing means as monitor 300 and producing means as monitor 300 
to produce a database of flows 324, as shown on Fig. 1 5 and 28:37-55. 
6. Regarding claims 3, 8 and 14, Dietz teaches retrieving a list of the protocols liable to 
appear at the level considered (retrieving pattern recognition structure/signature from data base 
336, as shown on Fig. 3 and 12:12-22); 

carrying out a frame-by-frame analysis of the stream in making a frame sequentially 
confront all the protocol signatures envisaged so long as the frame is not associated with a 
signature (parser 301 performing the packet comparison with all available protocol signatures to 
identify the protocol 1 1 :59- 12:22); 

retrieving the rule by packet of each fi^ame recognized (retrieving/building the flow key 
3 1 2, as shown on Fig. 3 and 1 3:20-30); 
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classifying the frames as a function of the rules and positioning them in distinct streams 
(classifying and separating the packets into flows, as shown on Fig. 3 and 13:54-14:57) and; 
carrying out a total analysis of the distinct streams in using the recognized protocol or protocols; 

associating the stream rule coming from the analysis (analyzing the packets flows, 
ijdentified by the flow signatures, in real time for each protocol up to the application level, as 
disclosed on 16:1-20). 

In addition, regarding claim 14, Dietz teaches means for performing the operations 
described above, as monitor 300, shown on Fig. 15. 

7. Regarding claims 4, 9, 1 1 and 1 5, Dietz teaches performing analysis of all packets 
utilizing statistics 4:64-5: 14: 

8. Regarding claim 5, Dietz teaches analyzing the network utilizing TCP/IP protocol , as 
disclosed on 5:55-67. 

Claim Rejections - 35 USC § 103 ^ 

9. The following is a quotation of 35 U.S.C. 1 03(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinaiy skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

10. Claims 2, 7 and 13 are rejected under 35 U.S.C. 103(a) as being unpatentable over Dietz. 
Dietz substantially teaches the limitations of claims 2, 7 and 13: 

1) analyzing the captured packet (analyzing packets at parser 301, as shown on Fig. 3 and 
12:12-24): 
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1 .b) if the packet is recognized, eliminating the packet from the captured stream, 
searching for an existing stream in order to insert the packet, and if there is no existing stream, 
generating a new stream (recognizing the packet a part of the existing flow and saving the packet 
at flow data base 324, or creating a new flow and saving it at the database 324, shown on Fig. 3 
and 13:14-14:55. wherein the monitor removes the packet which has been analyzed from the 
analyzed stream as the monitor moves to the next packet), 

2) analyzing the streams generated at the step 1) (analyzing flow 14:63-66). 

Dietz does not teach passing to the next packet, if the packet is not recognized, and 
releasing the system resources at the end of the operation. 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to add if the packet is not recognized, passing to the next packet and releasing the 
system resources to the system of Dietz to improve the system operation in noisy environment to 
proceed with the flovv analysis, as one of the packets is not recognized, and to release the 
protocol related information/signature at the end of the stream analysis, to make the system ready 
for next stream analysis. 

1 1 . Regarding claim 10, Dietz teaches performing analysis of all packets utilizing statistics 
4:64-5:14. 

Con ci us ion 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Dmitry Levitan whose telephone number is (571) 272-3093. The 
examiner can normally be reached on 8:30 to 4:30. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Lynn Feild can be reached on (571) 272-2092, The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would 
like assistance from a USPTO Customer Service Representative or access to the automated 
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 
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Primary Examiner 
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